hMailServer 6.2.22-pre2: DMARC aggregate reports (rua) are now sent, not just consumed
-
This was the second pre-release in the 6.2.22 line. Everything in it shipped in 6.2.24. Nothing here should be installed today.
hMailServer has consumed DMARC policy for years and produced nothing for the domains whose mail it receives. This pre-release adds DMARC aggregate reporting (rua, RFC 7489). Every evaluation is aggregated per UTC day and per policy domain, passes included, and the Appendix C XML is mailed to the addresses a domain asks for with
rua=. It stays inert until DmarcRptFromAddress is set.What the upgrade involved
The database schema moves to 6015. Upgrading from pre1 requires DBUpdater. Known limitations: FETCH BINARY on a composite section returns an empty literal, so BINARY[], multipart and message/rfc822 sections come back empty (leaf parts are correct). DMARC report data lives in memory, so a restart before the daily send loses that day's statistics.
Reporting
- RFC 7489 §7.1 external-destination verification is enforced. A rua target outside the policy domain's own organizational domain is used only when
<policy-domain>._report._dmarc.<target-domain>says it wants the reports. - Forensic (ruf) reports are deliberately not implemented.
Utilities.SendTlsRptReports(IncludeCurrentDay)and its twinSendDmarcReportssend what has been collected so far, not just days that are over. Both refuse, statistics preserved, when the From address is unset.
Authentication
AccountLockoutThresholdcounts failures by the name being guessed at, so a distributed attack that never crosses any single IP's auto-ban threshold is still caught. Off by default, enforced on every path including SCRAM. A locked name gets the ordinary invalid-credentials reply, and that refusal is kept out of the per-IP auto-ban.- POP3 AUTH-RESP-CODE (RFC 3206): credential failures carry
[AUTH], a failed inbox load carries[SYS/TEMP]. A transient database problem made scheduled clients nag for a password that was never wrong.
Anti-virus
A scan that could not run was delivered with one line in the error log, indistinguishable from a clean scan.
AVFailAction0 (the default) keeps today's behaviour. 1 holds the message, re-attempts it and returns it to the sender rather than delivering it unscanned.IMAP
BINARY (RFC 3516) decodes a part's Content-Transfer-Encoding server-side, and APPEND accepts the literal8 (
~{n}) form. OBJECTID (RFC 8474): EMAILID follows a message through copies, MAILBOXID survives RENAME, THREADID is answered NIL.Fixes
/Testno longer terminates on an unhandled exception when the machine has no network or a third party's DNS breaks. An idle server stops in about half a second rather than up to two. Nine settings reachable only by editing the ini now have Control Panel fields. - RFC 7489 §7.1 external-destination verification is enforced. A rua target outside the policy domain's own organizational domain is used only when
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login